washington

Biomedical researchers would face federal criminal sanctions for illegally obtaining or divulging protected medical information under recommendations for legislation that Donna Shalala, the US secretary of health and human services, is expected to send to Congress next week.

The recommendations “will make it clear that all researchers must carefully protect the privacy of the personal information they receive — and we recommend penalties if they don't,” Shalala said in a speech at the National Press Club in Washington DC.

Declaring that medical privacy is in crisis — a reference to many recent cases concerning the leaking of medical records, such as that of a student in Colorado caught selling patient files to malpractice lawyers — Shalala said it was important that Congress should act rapidly with federal legislation. “We need to enforce our messages with real criminal penalties for abuse. ”

The Health Insurance Portability and Accountability Act of 1996 requires Shalala to send to Congress by 21 August recommendations on how to ensure the privacy of health information about potentially identifiable individuals. Congress must then write a medical privacy law by 1999; if it fails to do so, she must implement new regulations.

According to sources, Shalala's recommendations will resemble a bill introduced in the House of Representatives by Gary Condit (Democrat, California). This would impose five- to ten-year prison terms on researchers, health-care providers, insurance companies and others with access to private medical information who knowingly disclose or sell it to unauthorized others, or who come into its possession improperly or fraudulently.

In addition to criminal penalties, the Condit bill allows the secretary of health and human services to levy civil fines of up to $10,000 on those who show a pattern of divulging protected information, a move aimed at those who traffic in medical records rather than those who have merely been careless. It also allows aggrieved patients to sue for compensatory and punitive damages those who unlawfully obtain or divulge information.

The bill defines “protected health information” as “any information, whether oral or recorded in any form or medium. . . with respect to which there is a reasonable basis to believe that the information can be used to identify the individual”.

But, despite the stiff criminal penalties, researchers who behave ethically should not be alarmed if the recommendations become law, says Robert Gellman, an expert on medical privacy policy who helped to draft the Condit bill and headed a subcommittee that advised Shalala on her recommendations.

Gellman says that any law resembling the “middle-of-the-road” Condit bill would be “very simple, straightforward and not threatening” for researchers in practice.

Researchers will have to make sure that they protect information properly, says Gellman. “But it's all going to be administrative and easy to do. The Condit bill gives researchers lots of flexibility.” Sharing information between researchers would not be prohibited, provided the researchers have the approval of a local ethics committee known as an institutional review board.

Perhaps most importantly for researchers, both the Condit bill and Shalala's expected recommendations would continue the practice of allowing researchers access to the medical records of identifiable individuals, without consent, provided that the research is determined by a review board to be, as the Condit bill states, “of sufficient importance so as to outweigh the intrusion into the privacy of the protected individual”.

In this, the Condit bill is less restrictive than others introduced or being drafted. For instance, a bill introduced in the House by Jim McDermott (Democrat, Washington) would require explicit informed patient consent for research using identifiable records.

Shalala's recommendations are not expected to address the issue of the tens of millions of archived tissue specimens stored in pathology laboratories around the country. A subcommittee of the National Bioethics Advisory Commission is formulating separate recommendations on this issue.

Nor will the recommendations necessarily be heeded by Congress, which is acutely sensitive to public opinion. In one poll, 85 per cent of Americans called medical privacy very important or essential, and 31 per cent rejected researcher access to records without consent. In Washington, privacy advocacy groups such as the Coalition for Patient Rights are backing more restrictions on researchers.

“Researchers are greatly at risk not because of criminal penalties but because [other proposals have] at least a modest chance of restricting access that they have today,” says Gellman.

On the other side of the debate, the pharmaceutical industry has warned against restrictive laws. “Proposals intended to protect individuals from the misuse of medical information could substantially impair our ability to conduct clinical trials,” says Richard Kent, vice-president and director of worldwide clinical research at Glaxo-Wellcome.

Addressing a subcommittee of the National Committee on Vital and Health Statistics in February, on behalf of the Pharmaceutical Research and Manufacturers of America, Kent said such proposals would make trials “more expensive or altogether impossible”.